Guides & Documentation
Everything you need to implement cookie consent on your website
Showing 212 guides in Compliance
Utah UCPA Cookie Compliance: The 2026 Guide
Utah wrote the most business-friendly privacy law in the country. Live since December 31, 2023, the UCPA skips the universal opt-out mandate, asks only for notice-and-opt-out on sensitive data, and covers far fewer companies thanks to a $25 million revenue gate.
Universal Opt-Out Mechanisms: Which States Require Them
A universal opt-out mechanism lets people opt out of data sales across every site at once. Roughly a dozen states now make honoring one legally mandatory. Here is the map and how to comply.
Turkey KVKK Cookie Consent: 2026 Guide
Turkey's data authority published dedicated cookie guidance in June 2022 and amended the underlying law in 2024. Here's how the KVKK treats cookies: explicit consent by default, two narrow exceptions, and what the reforms changed.
Thailand PDPA Cookie Consent: 2026 Rules
Thailand's PDPA has been fully enforceable since June 2022, and the PDPC moved to active enforcement in 2024 and 2025. Here's how the law treats cookies: explicit opt-in consent, no implied consent from browsing, and records you have to keep.
Texas TDPSA Cookie Compliance: The 2026 Rules
Texas has no cookie-banner law. It has the TDPSA (live since July 1, 2024), a universal opt-out mandate that turned on January 1, 2025, and an attorney general running one of the most aggressive privacy enforcement operations in the country.
How to Test Your Cookie Banner Is Compliant
A 2023 study found most EU cookie banners still fail. Building one right and verifying it works are different jobs. This is the QA pass you run after launch: the network-tab tests, the button rules, and the signals that trip up real audits.
The TCF and GPP Stub: Async Loading Done Right
Vendor scripts call the CMP API before the CMP finishes loading. The stub is what keeps those early calls from throwing. Here's how the stub, the locator iframe, and the command queue work together.
TCF and Google Additional Consent Explained
Google runs ad tech partners that aren't on the IAB Global Vendor List, so TCF alone can't signal consent for them. The Additional Consent (AC) string fills the gap. Here's the format and how a CMP produces it.
Managing the TCF Global Vendor List (GVL)
The Global Vendor List is a large JSON document that changes weekly. Here's how to load it without slowing every page, why the slim and full variants exist, and how the version field ties back to the TC String.
Building a TCF CMP That Passes IAB Validation
What it takes for a Consent Management Platform to pass IAB Europe's TCF checks: a registered CMP ID, a cleanly decodable TC String, event-listener delivery, and encoding against the right GVL version.
Switzerland's Revised FADP: Cookie Consent in 2026
Switzerland isn't in the EU, and its cookie rules follow a different logic: risk-based, opt-out for low-risk cookies, opt-in for advertising and profiling. Here's how the revised FADP and the 2025 FDPIC guidance actually work.
Switching Analytics or Marketing Vendors? Handle the Cookie Changes
Replacing one tracking tool with another quietly rewrites your cookie inventory and your data recipients. Here's how to swap vendors without leaking trackers or orphaning cookies.
SvelteKit Cookie Consent: The 2026 Setup Guide
SvelteKit renders on the server and hydrates on the client, which means a tracker in app.html or an onMount call can fire before consent. Here's where the consent loader belongs, how to block scripts until opt-in, and how to check consent in hooks.server.ts.
Cookie Consent for Streaming and Video Sites: The VPPA Problem
A 1988 law written for video-rental stores now drives class actions against any website that puts a tracking pixel near a video player. Here's how streaming and video sites handle the Video Privacy Protection Act alongside GDPR and state consent rules.
South Korea's PIPA: Cookie Consent Rules for 2026
South Korea is one of the strictest consent regimes on the planet, and its regulator proves it. The PIPC has fined Google and Meta a combined 100 billion won for behavioral-ad tracking without consent. Here's how PIPA treats cookies after the 2023 overhaul.
Social Embeds and Consent: The Click-to-Load Pattern
Instagram, X, TikTok, and Facebook embeds load third-party scripts and set cookies before anyone interacts. A CJEU ruling makes you a joint controller for that data flow. Click-to-load fixes it.
SOC 2 and Privacy: What the Report Says About Cookies
SOC 2 is the report enterprise buyers ask for first, but its Privacy category is the one most companies skip. Here's what SOC 2 actually attests, how the Privacy criterion works, and why your cookie consent records show up in the audit.
Singapore PDPA Cookie Consent: 2026 Guide
Since October 2022, Singapore's regulator can fine organisations up to 10% of local turnover for data breaches. Here's how the PDPA treats cookies, how deemed consent works, and why ignored browser settings don't count as agreement.
How to Set Up Google Consent Mode With a CMP
Consent Mode v2 has been required since March 2024 to keep Google ad and measurement features working in the EEA. Here's the end-to-end setup wiring your CMP to Google's seven consent signals, step by step.
Sensitive Data Under US State Privacy Laws in 2026
Health data, precise location, and other sensitive categories get special treatment under US state laws, and the rules split between opt-in consent and a right to limit. Here is how to handle them.
Safari ITP Explained for Marketers
Safari blocks every third-party cookie and deletes JavaScript-set cookies after seven days. Here's what Intelligent Tracking Prevention does to your measurement, and what it doesn't.
ROPA for Cookies: Building an Article 30 Record for Your Trackers
GDPR Article 30 requires most organisations to keep a written record of their processing activities. Here's how to turn a cookie and tracker inventory into ROPA entries a supervisory authority will accept.
The Right to Be Forgotten: Handling Erasure Requests in Practice
The right to erasure is not a delete button, and it is not absolute. Here is how to work an Article 17 request end to end: the six grounds, the exemptions that let you keep data, backups, the Article 19 downstream notification, and the CCPA right to delete in parallel.
Cookie Consent for Job Boards and Recruitment Sites
The EU AI Act makes recruitment AI high-risk from August 2026, and the ICO has put automated hiring decisions on its enforcement list. Here's how job boards and career sites should handle cookie consent for candidate data.